# Elastalert - Connection aborted

**URL:** <https://discuss.elastic.co/t/elastalert-connection-aborted/215587>\
**Category:** Elasticsearch\
**Created:** [January 19, 2020, 1:55am UTC](https://discuss.elastic.co/t/elastalert-connection-aborted/215587 "2020-01-19T01:55:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Newtoelastic](https://avatars.discourse-cdn.com/v4/letter/n/8baadc/32.png) [@Newtoelastic](https://discuss.elastic.co/u/Newtoelastic)\
**Post date:** [January 19, 2020, 1:55am UTC](https://discuss.elastic.co/t/elastalert-connection-aborted/215587/1 "2020-01-19T01:55:06Z")

</div>

Hey there guys, first time trying to work with Elastalert.  
I am attempting to use the elastalert-create-index command and I getting an odd response back.  
I used the same host and port on all my other config files and everything seems to be working fine! yet when I try and run this command I am getting a connection aborted.

> raise ConnectionError("N/A", str(e), e) elasticsearch.exceptions.ConnectionError: ConnectionError(('Connection aborted.', RemoteDisconnected('Remote end closed connection without response',))) caused by: ConnectionError(('Connection aborted.', RemoteDisconnected('Remote end closed connection without response',)))

This is my config file.. What's wrong here? 😢

> #This is the folder that contains the rule yaml files  
> #Any .yaml file will be loaded as a rule  
> rules\_folder: example\_rules  
> #How often ElastAlert will query Elasticsearch  
> #The unit can be anything from weeks to seconds  
> run\_every:  
> minutes: 1  
> #ElastAlert will buffer results from the most recent  
> #period of time, in case some log sources are not in real time  
> buffer\_time:  
> minutes: 15  
> #The Elasticsearch hostname for metadata writeback  
> #Note that every rule can have its own Elasticsearch host  
> es\_host: "[a54cf51d3649451e9386271e10314481.eu-central-1.aws.cloud.es.io](http://a54cf51d3649451e9386271e10314481.eu-central-1.aws.cloud.es.io)"  
> #The Elasticsearch port  
> es\_port: 9243  
> #The AWS region to use. Set this when using AWS-managed elasticsearch  
> aws\_region: eu-central-1  
> #The AWS profile to use. Use this if you are using an aws-cli profile.  
> #See [Get started with the AWS CLI - AWS Command Line Interface](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html)  
> #for details  
> profile: test

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [January 19, 2020, 10:42am UTC](https://discuss.elastic.co/t/elastalert-connection-aborted/215587/3 "2020-01-19T10:42:36Z")

</div>

Please read carefully the [About the Elasticsearch category](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and specifically the "Also be patient" part. It is not polite to bump your thread after just 9 hours like you did.

Furthermore, Elastalert is a third-party plugin so you will likely get more useful support from a more Elastalert-focussed forum. The recommended way to do alerting with Elasticsearch is with [Watcher](https://www.elastic.co/guide/en/kibana/current/watcher-ui.html).

---

<div class="post-metadata">

**Author:** ![Newtoelastic](https://avatars.discourse-cdn.com/v4/letter/n/8baadc/32.png) [@Newtoelastic](https://discuss.elastic.co/u/Newtoelastic)\
**Post date:** [January 19, 2020, 10:44am UTC](https://discuss.elastic.co/t/elastalert-connection-aborted/215587/4 "2020-01-19T10:44:16Z")

</div>

Sorry about that David, I didn't know about that bumping policy!

I am attempting to learn elastalert so watcher isn't exactly what I am aiming at but thank you for taking the time and responding anyhow

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2020, 10:44am UTC](https://discuss.elastic.co/t/elastalert-connection-aborted/215587/5 "2020-02-16T10:44:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.